UPDATES: Urgent PHP vulnerabilities - patching and mitigation for Webslice Containers and Serverless

Update - 22/10/2026, 10:30pm (UTC)

We've updated Webslice Container images for PHP 8.2, PHP 8.3, PHP 8.4 and PHP 8.5, as well as back ported patches for PHP 7.4, 8.0 and 8.1, to address the PHP security vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.

We have rolled out automatic updates to all Webslice Serverless images, and managed Webslice Containers.

Webslice Container images listed below have already been updated and are available now:

• Nginx (PHP 8.5, 8.4, 8.3, 8.2)

• Apache (PHP 8.5, 8.4, 8.3, 8.2)

• WordPress (PHP 8.5, 8.4, 8.3, 8.2)

• Silverstripe (PHP 8.3)

If you are running any version of PHP earlier than 8.2, and you can update to a newer version, we recommend updating ASAP.

To update Webslice Container images

Managed Webslice Containers

We are rolling out automatic updates to all managed Webslice Container customers. Please note that the Webslice Console will update some time after patching has happened.

Unmanaged Webslice Containers

If you're using unmanaged Webslice Containers, please log in to the Webslice Console and manually update containers to the latest available image. Inside the Webslice Console, open the Containers screen, then click the NV tag ("new version") that displays alongside images that are ready to update. We highly recommend that you do this as soon as possible.

We will provide further updates as the rollout progresses.

---

PHP has announced an urgent security update for two critical vulnerabilities that will be rolled out in the coming hours. Both vulnerabilities were given severity ratings of 9.2/10. They reportedly expose remote control execution vulnerabilities in PHP, which could potentially enable attackers to run their own code on a server and take control of it.

Their security team is aiming to release the fixes at 14:00 UTC (21 October 2026).

In the meantime, To protect your sites from these critical PHP vulnerabilities we have disabled PHP's session.upload_progress.enabled setting for all Webslice Containers. This setting is On by default, but for most websites it's unlikely to make any practical difference to you or your customers.Webslice Serverless

We have also applied these changes to Webslice Serverless images, and have contacted impacted customers.

The change should protect you from the attack, and we don't expect it to affect normal website functionality or file uploads. However, websites that specifically rely on PHP's built-in upload progress tracking may experience some impact. If you accept file uploads via any websites, that functionality could be affected.

If you notice any unexpected behavior on your website following this change, please contact us so we can investigate.

As soon as the update is available, we’ll be updating Webslice Container images and tagging them with the NV (new version) flag. When you see the NV flag, you can then click and update the image. We very strongly encourage you to click and update your Containers when new images are available.

Differences for managed and unmanaged Webslice Containers 

If you don’t update your Webslice Container images when the new PHP versions are available, there are some differences depending on your setup. 

A world of vulnerabilities

Vulnerabilities are being discovered more quickly and more frequently than ever before, and they’re also being exploited much sooner. 

If patching images at the drop of a hat isn't something you want to be doing manually, we totally understand. This patching is a perfect demonstration of the value of Support & Management.

If you’d like to talk with us about adding Support & Management, we’re always ready to talk.